[pve-devel] r5356 - in pve-manager/pve2: . bin debian lib/PVE www www/manager www/templates

svn-commits at proxmox.com svn-commits at proxmox.com
Tue Jan 11 16:04:52 CET 2011


Author: dietmar
Date: 2011-01-11 16:04:52 +0100 (Tue, 11 Jan 2011)
New Revision: 5356

Removed:
   pve-manager/pve2/lib/PVE/AuthCookieHandler.pm
   pve-manager/pve2/www/startup.pl
Modified:
   pve-manager/pve2/ChangeLog
   pve-manager/pve2/bin/pvecert
   pve-manager/pve2/debian/control.in
   pve-manager/pve2/lib/PVE/Cluster.pm
   pve-manager/pve2/lib/PVE/Makefile.am
   pve-manager/pve2/lib/PVE/REST.pm
   pve-manager/pve2/www/Makefile.am
   pve-manager/pve2/www/manager/startup.pl
   pve-manager/pve2/www/templates/pve.conf.in
Log:
	* lib/PVE/REST.pm (create_ticket): use PVE::AccessControl to
	create/&verify tickets

	* lib/PVE/AuthCookieHandler.pm: removed file



Modified: pve-manager/pve2/ChangeLog
===================================================================
--- pve-manager/pve2/ChangeLog	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/ChangeLog	2011-01-11 15:04:52 UTC (rev 5356)
@@ -1,3 +1,10 @@
+2011-01-11  root  <root at maui.maurer-it.com>
+
+	* lib/PVE/REST.pm (create_ticket): use PVE::AccessControl to
+	create/&verify tickets
+
+	* lib/PVE/AuthCookieHandler.pm: removed file
+
 2010-08-27  Proxmox Support Team  <support at proxmox.com>
 
 	* bin/pvesh (list_dir): do not display all data - instead display

Modified: pve-manager/pve2/bin/pvecert
===================================================================
--- pve-manager/pve2/bin/pvecert	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/bin/pvecert	2011-01-11 15:04:52 UTC (rev 5356)
@@ -5,6 +5,7 @@
 use Getopt::Long;
 use PVE::RPCEnvironment;
 use PVE::INotify qw(read_file);
+use PVE::AccessControl;
 
 $ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
 
@@ -35,29 +36,10 @@
 # make sure we have a CA
 my $force = PVE::Cluster::gen_pveca_cert();
 
+$force = 1 if $opt_force;
+
 PVE::Cluster::gen_pve_ssl_cert ($force, $hostname);
 
-exit 0;
+PVE::AccessControl::cond_create_auth_key();
 
-eval { 
-    # make sure we have a private key
-    PVE::Cluster::gen_pve_ssl_key();
-
-    # make sure we have a CA
-    my $force = PVE::Cluster::gen_pveca_cert();
-
-    $force = 1 if $opt_force;
-
-    my $cinfo = PVE::Cluster::clusterinfo();
-
-    PVE::Cluster::gen_pve_ssl_cert ($force, $cinfo);
-};
-
-my $err = $@;
-
-if ($err) {
-    print STDERR "ERROR: $err";
-    exit (-1);
-}
-
 exit (0);

Modified: pve-manager/pve2/debian/control.in
===================================================================
--- pve-manager/pve2/debian/control.in	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/debian/control.in	2011-01-11 15:04:52 UTC (rev 5356)
@@ -3,7 +3,7 @@
 Section: admin
 Priority: optional
 Architecture: all
-Depends: perl5, libtimedate-perl, apache2-mpm-prefork, libauthen-pam-perl, libintl-perl, rsync, libapache-authcookie-perl, libapache2-request-perl, libjson-perl, libdigest-sha1-perl, libio-stringy-perl, vncterm, qemu-server (>= 1.1-1), libwww-perl, wget, libnet-dns-perl, vlan, ifenslave-2.6 (>= 1.1.0-10), liblinux-inotify2-perl, debconf (>= 0.5) | debconf-2.0, libjs-prototype (>= 1.6.0.3-1), netcat-traditional, pve-cluster, libpve-common-perl, libpve-storage-perl, libterm-readline-gnu-perl, libhttp-request-params-perl, libpve-access-control
+Depends: perl5, libtimedate-perl, apache2-mpm-prefork, libauthen-pam-perl, libintl-perl, rsync, libapache2-request-perl, libjson-perl, libdigest-sha1-perl, vncterm, qemu-server (>= 1.1-1), libwww-perl, wget, libnet-dns-perl, vlan, ifenslave-2.6 (>= 1.1.0-10), liblinux-inotify2-perl, debconf (>= 0.5) | debconf-2.0, libjs-prototype (>= 1.6.0.3-1), netcat-traditional, pve-cluster, libpve-common-perl, libpve-storage-perl, libterm-readline-gnu-perl, libhttp-request-params-perl, libpve-access-control
 Conflicts: netcat-openbsd
 Maintainer: Proxmox Support Team <support at proxmox.com>
 Description: The Proxmox Virtual Environment

Deleted: pve-manager/pve2/lib/PVE/AuthCookieHandler.pm
===================================================================
--- pve-manager/pve2/lib/PVE/AuthCookieHandler.pm	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/lib/PVE/AuthCookieHandler.pm	2011-01-11 15:04:52 UTC (rev 5356)
@@ -1,120 +0,0 @@
-package PVE::AuthCookieHandler;
-
-use strict;
-
-use Carp;
-use CGI '3.12';
-use mod_perl2 '1.9922';
-
-use Apache::AuthCookie::Util;
-use Apache2::RequestRec;
-use Apache2::RequestUtil;
-use Apache2::Log;
-use Apache2::Access;
-use Apache2::Response;
-use Apache2::Util;
-use APR::Table;
-use Apache2::Const qw(:common M_GET HTTP_FORBIDDEN HTTP_MOVED_TEMPORARILY);
-use URI::Escape;
-use Digest::SHA1;
-use PVE::SafeSyslog;
-use PVE::Utils;
-use base qw(Apache2::AuthCookie);
-use Encode;
-
-my $secret = (split (/\s/, `md5sum /etc/pve/pve-ssl.key`))[0];
-
-sub sign_soap_ticket {
-    my ($ticket) = @_;
-
-    my ($username, $group, $time, $mac) = split /::/, $ticket;
-
-    my $digest = Digest::SHA1::sha1_hex($username, $group, $time, $mac, $secret);
-
-    return "${ticket}::$digest";
-}
-
-sub authen_cred {
-    my $self = shift;
-    my $r = shift;
-    my ($username, $password) = @_;
-
-    # login.pl encodes data in uft-8
- 
-    my $ticket;
-    eval { $ticket = PVE::ConfigClient::request_ticket ($username, $password); };
-    my $err = $@;
-
-    if ($err) {
-	syslog ('err', "login failure: $err");
-	return undef;
-    }
-
-    return sign_soap_ticket ($ticket);
-}
-
-sub authen_ses_key {
-    my $self = shift;
-    my $r = shift;
-    my $session_key = shift;
-
-    my $uri = $r->uri;
-
-    my ($username, $group, $age, $mac) = PVE::Utils::verify_web_ticket ($secret, $session_key);
-
-    if ($username && $group) {
-
-	# update session key
-	# - but not for web services
-	# - only if older than 2 minutes
-	if ($age > 120 && $uri !~ m|^/ws/|) {
-	    syslog ('info', "update ticket");
-
-	    my $ticket;
-	    eval { 
-		$ticket = PVE::ConfigClient::update_ticket ($session_key); 
-		$session_key = sign_soap_ticket ($ticket);
-		$self->send_cookie ($r, $session_key);
-	    };
-	    my $err = $@;
-
-	    syslog ('err', "update ticket failed: $err") if $err;
-	}
-
-	return $username;
-    }
-
-    return undef;
-}
-
-sub group {
-    my ($self, $r, $args) = @_;
-
-    my $cookie = $self->key ($r);
-
-    my ($username, $group) = split /::/, $cookie;
-
-    if ($args eq $group) {
-	return OK;
-    }
-
-    return FORBIDDEN;
-}
-
-
-sub login_form {  
-  my ($self, $r) = @_;
-
-  my $uri = $r->uri;
-
-  # no login for for web services
-  if ($uri =~ m|^/ws/|) {
-      my $code = AUTH_REQUIRED;
-      $r->custom_response($code, '');
-      return $code;
-  }
-
-  return $self->SUPER::login_form ($r);
-}
-
-1;

Modified: pve-manager/pve2/lib/PVE/Cluster.pm
===================================================================
--- pve-manager/pve2/lib/PVE/Cluster.pm	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/lib/PVE/Cluster.pm	2011-01-11 15:04:52 UTC (rev 5356)
@@ -18,7 +18,7 @@
 my $pveca_key_fn = "$basedir/priv/pve-root-ca.key";
 my $pveca_srl_fn = "$basedir/priv/pve-root-ca.srl";
 my $pveca_cert_fn = "$basedir/pve-root-ca.pem";
-my $pvessl_key_fn = "$basedir/local/priv/pve-ssl.key";
+my $pvessl_key_fn = "$basedir/local/pve-ssl.key";
 my $pvessl_cert_fn = "$basedir/local/pve-ssl.pem";
 
 sub gen_local_dirs {
@@ -40,12 +40,9 @@
     
     return if -f $pveca_key_fn;
 
-    my $old_umask = umask();
     eval {
-	umask (0177);
 	PVE::Utils::run_command (['openssl', 'genrsa', '-out', $pveca_key_fn, '1024']);
     };
-    umask ($old_umask);
 
     die "unable to generate pve ca key:\n$@" if $@;
 }
@@ -88,8 +85,7 @@
 sub update_serial {
     my ($serial) = @_;
 
-    my $old_umask = umask();
-    system ("echo '$serial' > '$pveca_srl_fn'");
+    PVE::Tools::file_set_contents($pveca_srl_fn, $serial);
 }
 
 sub gen_pve_ssl_cert {

Modified: pve-manager/pve2/lib/PVE/Makefile.am
===================================================================
--- pve-manager/pve2/lib/PVE/Makefile.am	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/lib/PVE/Makefile.am	2011-01-11 15:04:52 UTC (rev 5356)
@@ -8,7 +8,6 @@
 	APIDaemon.pm		\
 	REST.pm			\
 	SourceFilter.pm		\
-	AuthCookieHandler.pm	\
 	URLRewrite.pm		\
 	I18N.pm			\
 	HTMLUtils.pm		\

Modified: pve-manager/pve2/lib/PVE/REST.pm
===================================================================
--- pve-manager/pve2/lib/PVE/REST.pm	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/lib/PVE/REST.pm	2011-01-11 15:04:52 UTC (rev 5356)
@@ -2,7 +2,9 @@
 
 use warnings;
 use strict;
+use Digest::SHA1 qw(sha1_base64);
 use PVE::SafeSyslog;
+use PVE::Tools;
 use PVE::API2;
 use Apache2::Const;
 use CGI;
@@ -13,12 +15,15 @@
 use HTTP::Status qw(:constants :is status_message);
 use HTML::Entities;
 use PVE::JSONSchema;
+use PVE::AccessControl;
 
 use Data::Dumper; # fixme: remove
 
 my $realm = 'PVE API Server';
 my $cookie_name = 'PVEAuthCookie';
 
+my $secret;
+
 my $baseuri = "/api2";
 
 # http://perl.apache.org/docs/2.0/api/Apache2/SubProcess.html
@@ -31,24 +36,24 @@
     return $cookie;
 }
 
-sub verify_ticket {
-    my ($ticket) = shift;
+sub create_ticket {
+    my ($user, $pw) = @_;
 
-    if ($ticket eq "root::root::") {
-	return ("root", 10);
-    }
+    my $euid = $>;
 
-    return undef;
-}
+    my $ticket;
+    eval {
+	$user = PVE::AccessControl::authenticate_user($user, $pw);
+	$ticket = PVE::AccessControl::assemble_ticket($user);
+    };
+    my $err = $@;
 
-sub create_ticket {
-    my ($user, $pw) = @_;
+    if ($err) {
+	syslog('err', $err);
+	return undef;
+    }
 
-    if ($user eq 'root' and $pw eq 'admin') {
-	return "root::root::";
-    } 
-
-    return undef;
+    return $ticket;
 }
 
 sub extract_auth_cookie {
@@ -273,11 +278,11 @@
     }
 
     my ($username, $age);
-    ($username, $age) = verify_ticket ($ticket) if $ticket;
+    ($username, $age) = PVE::AccessControl::verify_ticket($ticket, 1) if $ticket;
 
     return { status => HTTP_UNAUTHORIZED } if !($ticket && $username);
 
-    syslog ('info', "GOT $method $abs_uri VALID TICKET $ticket");
+    #syslog ('info', "GOT $method $abs_uri VALID TICKET $ticket");
     
     my $uri_param = {};
     my ($handler, $info) = PVE::API2->find_handler($method, $rel_uri, $uri_param);

Modified: pve-manager/pve2/www/Makefile.am
===================================================================
--- pve-manager/pve2/www/Makefile.am	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/www/Makefile.am	2011-01-11 15:04:52 UTC (rev 5356)
@@ -2,11 +2,6 @@
 
 SUBDIRS = templates images ext css manager
 
-bin_SCRIPTS = 			\
-	startup.pl
-
-bindir = ${WWW_BASEDIR}
-
 install-data-hook:
 	chown -R www-data:www-data ${DESTDIR}${WWW_BASEDIR}
 

Modified: pve-manager/pve2/www/manager/startup.pl
===================================================================
--- pve-manager/pve2/www/manager/startup.pl	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/www/manager/startup.pl	2011-01-11 15:04:52 UTC (rev 5356)
@@ -28,15 +28,24 @@
 
 use PVE::pvecfg;
 use PVE::REST;
-use PVE::Config;
+use PVE::INotify;
+use PVE::RPCEnvironment;
 
 sub childinit {
     syslog ('info', "Starting new child $$");
+    PVE::INotify::inotify_init();
+    PVE::RPCEnvironment->init('pub');
+
     PVE::Config::inotify_init();
 }
 
+sub childexit {
+    syslog ('info', "Finish child $$");
+}
+
 my $s = Apache2::ServerUtil->server;
 $s->push_handlers(PerlChildInitHandler => \&childinit);
+$s->push_handlers(PerlChildExitHandler => \&childexit);
 
 1;
 

Deleted: pve-manager/pve2/www/startup.pl
===================================================================
--- pve-manager/pve2/www/startup.pl	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/www/startup.pl	2011-01-11 15:04:52 UTC (rev 5356)
@@ -1,51 +0,0 @@
-#!/usr/bin/perl -w
-
-use strict;
-
-use PVE::SafeSyslog;
-
-use ModPerl::Util (); #for CORE::GLOBAL::exit
-
-use Apache2::RequestRec ();
-use Apache2::RequestIO ();
-use Apache2::RequestUtil ();
-use Apache2::Access;
-use Apache2::Response;
-use Apache2::Util;
-  
-use Apache2::ServerUtil ();
-use Apache2::Connection ();
-use Apache2::Log ();
-  
-use APR::Table ();
-  
-use ModPerl::Registry ();
-  
-use Apache2::Const -compile => ':common';
-use APR::Const -compile => ':common';
-
-initlog ('proxwww', 'daemon');
-
-use HTML::Entities;
-use PVE::pvecfg;
-use PVE::AuthCookieHandler;
-use PVE::REST;
-use PVE::INotify;
-use PVE::RPCEnvironment;
-
-sub childinit {
-    syslog ('info', "Starting new child $$");
-    PVE::INotify::inotify_init();
-    PVE::RPCEnvironment->init('pub');
-}
-
-sub childexit {
-    syslog ('info', "Finish child $$");
-}
-
-my $s = Apache2::ServerUtil->server;
-$s->push_handlers(PerlChildInitHandler => \&childinit);
-$s->push_handlers(PerlChildExitHandler => \&childexit);
-
-1;
-

Modified: pve-manager/pve2/www/templates/pve.conf.in
===================================================================
--- pve-manager/pve2/www/templates/pve.conf.in	2011-01-11 14:42:40 UTC (rev 5355)
+++ pve-manager/pve2/www/templates/pve.conf.in	2011-01-11 15:04:52 UTC (rev 5356)
@@ -68,7 +68,7 @@
     SSLEngine on
     SSLProtocol all -SSLv2
     SSLCertificateFile @PROXMOX_ETC@/local/pve-ssl.pem
-    SSLCertificateKeyFile @PROXMOX_ETC@/local/priv/pve-ssl.key
+    SSLCertificateKeyFile @PROXMOX_ETC@/local/pve-ssl.key
 
     RewriteEngine on
     RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)



More information about the pve-devel mailing list